An intelligent agent security protection device, method and terminal based on a trusted execution environment

Abstract

The application discloses an intelligent agent security protection device and method based on a trusted execution environment and a terminal, and relates to the technical field of intelligent agent security protection. The device comprises a general chip module, a security protection module and a remote verification server module. The general chip module is used for connecting a user side host service system. The security protection module builds a trusted execution environment through a hardware level isolation technology, and comprises a security chip and a computing chip. The remote verification server module and the security chip establish an encrypted trusted communication link through a national encryption algorithm, and only respond to verification requests initiated by a user. Through the cooperative mechanism of the built-in control execution of the computing chip and the tamper-proofing hardware level measurement of the security chip, the application realizes hardware level isolation of an intelligent agent running environment, fine control of operation behavior, trusted verification of the whole process, and fully resists all-scene security risks such as overreach operation of the intelligent agent, environment tampering, illegal access, behavior out of control and the like.

Description

Technical Field

[0001] This invention relates to the field of trusted computing technology, and in particular to a security protection device, method and terminal for intelligent agents based on a trusted execution environment. Background Technology

[0002] With the rapid iteration and commercialization of large language models and AI agent technologies, agents, with their autonomous perception, decision-making, and execution capabilities, are widely used in various industry scenarios such as business process processing, automated operation and maintenance, data processing, transaction execution, and equipment management. They can replace manual labor in completing a series of complex tasks such as document processing, system operation, multi-application linkage, data retrieval, and instruction execution, significantly improving production efficiency and business automation levels.

[0003] However, the large-scale, multi-scenario application of agents brings new security risks and challenges: On the one hand, agents have the ability to autonomously execute system commands, access core sensitive data of enterprises / industries, and control business devices. If problems such as prompt injection, malicious command implantation, loss of control over behavioral logic, or unauthorized operation occur, it will directly lead to the leakage of core data, illegal control of business systems, and unauthorized operation of critical equipment, and may even trigger systemic security incidents such as financial risks, production safety accidents, and leakage of government data. On the other hand, most existing agents are deployed directly in general operating system environments, and the operating environment lacks hardware-level trusted isolation. Their operating data, execution logic, and control rules are easily stolen, tampered with, and hijacked by hackers and unauthorized personnel through system vulnerabilities. Traditional software-level protection solutions are difficult to resist low-level attacks.

[0004] Currently, most security protection solutions for agents focus on the software level, such as behavior auditing, command keyword filtering, application-layer permission control, or container isolation and software sandbox mechanisms based on the operating system. Trusted Execution Environments (TEEs), as a mature technology with hardware-level security isolation capabilities, have been widely used in data encryption, identity authentication, and financial payments. However, existing technologies lack a TEE-level integrated security protection device that covers the entire agent lifecycle and adapts to multiple industries and scenarios. This makes it impossible to achieve hardware-level isolation and behavior control throughout the entire agent deployment, operation, and management process. Furthermore, the control logic of existing solutions is often separated from the operating environment, or the control rules lack hardware-level anti-tampering protection, making them highly susceptible to unauthorized modification and bypass. This fails to address the core security pain points at their root, such as unauthorized agent operations, unauthorized modification of the operating environment, and unauthorized access.

[0005] Therefore, existing technologies still have shortcomings. Summary of the Invention

[0006] To address the aforementioned deficiencies in existing technologies, this invention provides an intelligent agent security protection device, method, and terminal based on a trusted execution environment. The technical solution adopted by this invention is as follows: In a first aspect, the present invention provides an intelligent agent security protection device based on a trusted execution environment, the device comprising: The general-purpose chip module serves as the user's operation access point, connecting to the user-side host business system. It is the only trusted interaction relay unit between the user and the security protection device, and between the intelligent agent and the host business system. The security protection module constructs a trusted execution environment independent of the general-purpose operating system through hardware-level isolation technology. The security protection module includes a security chip and a computing chip. The security chip is the root of trust and the core of measurement and control of the trusted execution environment. The computing chip is the intelligent agent operation and control execution unit in the trusted execution environment and is completely physically isolated from the general-purpose chip module and the host business system. The remote verification server module is a trusted third-party benchmark platform that provides legitimacy verification services. It is the core response node for user-initiated remote verification. The remote verification server module and the security chip establish an encrypted and trusted communication link through national cryptographic algorithms and only respond to verification requests initiated by users.

[0007] In one implementation, the general-purpose chip module is further specifically used for: Upon receiving a user's access command, it forwards it to the security chip within the security protection module via an encrypted and trusted link; The system receives the normal operation command of the intelligent agent after verification and approval by the security chip, and forwards it to the host business system to execute the corresponding operation, thereby completing the implementation of the intelligent agent's business capabilities. Physically block the direct access link between the intelligent agent and the host business system, and force all intelligent agents to perform external operations through the judgment process of the intelligent agent operation behavior security control engine of the computing chip and the trusted verification process of the security chip.

[0008] In one implementation, the security chip is further specifically used for: In conjunction with the remote verification server module, it completes the integrity verification of the trusted execution environment during the startup phase of the security protection device and the deployment phase of the intelligent agent, the legality verification of the intelligent agent application, and the verification of the baseline value of the control strategy, so as to build a complete trusted chain. The security management strategy for the operation behavior of the intelligent agent within the computing chip includes static integrity verification at startup and dynamic continuous measurement during runtime. It manages full access permissions to the trusted execution environment and continuously monitors and measures the operating status of the computing chip and the integrity of the agent program.

[0009] In one implementation, the computing chip is further specifically used for: It enables the entire process of large-scale model reasoning, behavioral decision-making, instruction generation, and data computation for all intelligent agents; All external operation commands generated by the intelligent agent are collected in real time, classified and judged, and initially controlled. Based on the built-in classification rule base, compliant and normal operation commands are submitted to the security chip for final release verification, while dangerous operation commands are intercepted locally.

[0010] In one implementation, the remote verification server module is further specifically used for: The system receives a user-initiated request to verify the legitimacy of the device and intelligent agent application. Simultaneously, it receives the device hardware identifier, trusted execution environment integrity metric, intelligent agent program hash value, and control policy metric value uploaded by the security chip, and compares and verifies them with the pre-stored trusted benchmark values ​​of genuine devices, legitimate intelligent agent programs, and control policy. Based on the verification results, a legality verification report for the device and intelligent agent application is generated, and the verification report is encrypted and fed back to the user who initiated the request and the security chip of the corresponding security protection device.

[0011] Secondly, embodiments of the present invention also provide a method for protecting intelligent agents based on a trusted execution environment, wherein the method is implemented based on the intelligent agent security protection device based on a trusted execution environment as described in any of the preceding claims, and the method includes: The intelligent agent security protection device is initialized with a trusted value and a baseline value is preset. The intelligent agent deployment request is initiated through the general chip module of the intelligent agent security protection device. Based on the security chip of the intelligent agent security protection device, the intelligent agent program and the corresponding management and control policy rules are securely deployed to the computing chip in the trusted execution environment, thus completing the trusted deployment of the intelligent agent. The system initiates a remote verification request for the legitimacy of the device and intelligent agent application through a general-purpose chip module, and completes the remote verification of the legitimacy of the device and intelligent agent application based on the remote verification server module, generating a legitimacy verification report. Based on the aforementioned legality verification report, the operation instructions of the verified intelligent agent program are classified and controlled according to the built-in hierarchical rule base, and access is blocked or instruction is denied for illegal access and intelligent agent programs that fail verification.

[0012] In one implementation, the agent security protection device undergoes trusted initialization and baseline value presetting. An agent deployment request is initiated through the general-purpose chip module of the agent security protection device. Based on the security chip of the agent security protection device, the agent program and corresponding management policy rules are securely deployed to the computing chip within the trusted execution environment, completing the trusted deployment of the agent. This includes: Before leaving the factory, the intelligent agent security protection device completes the hardware trusted root programming, the security chip completes its own firmware verification, generates a unique hardware identifier and hardware trusted benchmark value, and builds the basic trusted chain of the trusted execution environment. The device's unique hardware identifier, hardware trusted baseline value, and trusted execution environment's basic trusted baseline value are encrypted and uploaded to the remote verification server module to complete the baseline value preset for genuine devices. When the intelligent agent security protection device is powered on, the security chip completes its own hardware root of trust verification and basic integrity verification of the trusted execution environment, locks all external access links of the computing chip, and retains only the internal trusted link with the security chip. Users initiate intelligent agent deployment requests through general-purpose chip modules. After verification by security chips, the user's identity is trusted and operation permissions are verified. After user identity authentication is successful, the user uploads the intelligent agent program package and the adapted control policy rule package to the intelligent agent security protection device. The security chip calculates the hash value of the intelligent agent program package and the control policy rule package respectively to generate an initial trusted baseline value. After binding the hash value of the intelligent agent program, the baseline value of the control policy, and the unique hardware identifier of the device through the security chip, the data is encrypted and uploaded to the remote verification server module to complete the synchronization and storage of the baseline value of the legitimate intelligent agent program. By using a security chip, the intelligent agent program and its corresponding management and control policy rules are securely deployed to the computing chip within a trusted execution environment, thus completing the trusted deployment of the intelligent agent.

[0013] In one implementation, a remote verification request for the legitimacy of the device and the intelligent agent application is initiated through a general-purpose chip module, and the remote verification of the legitimacy of the device and the intelligent agent application is completed based on a remote verification server module, generating a legitimacy verification report, including: Before a user initiates a request to use the intelligent agent security protection device, a remote verification request for the legitimacy of the device and the intelligent agent application is initiated through a general chip module, while the user's identity is verified in a trusted manner. After receiving the user's verification request, the security chip collects the current device's unique hardware identifier, the real-time integrity metric of the trusted execution environment, calculates the real-time hash value of the intelligent agent program running in the chip, and the real-time integrity metric of the control policy in real time, and generates verification data that is encrypted and uploaded to the remote verification server module. The remote verification server module receives the user's verification request and the verification data uploaded by the security chip. It compares and verifies the verification data with the pre-stored hardware trusted benchmark value of the corresponding device, the benchmark hash value of the bound legitimate intelligent agent program, and the trusted benchmark value of the control policy one by one, and generates a legitimacy verification report. The remote verification server module encrypts and sends the legitimacy verification report back to the user who initiated the request and the security chip of the corresponding security protection device. The user can view the verification report through the general chip module to confirm the legitimacy of the device and the smart agent application. If the legality verification report shows that the device is a genuine and legitimate device, the trusted execution environment is complete and untampered, the running intelligent agent application is a bound, legitimate, and untampered version, and the control policy is complete and trustworthy, after the user confirms that the verification is passed, an operation authorization instruction is issued to the security protection device, allowing the user to initiate operation access to the intelligent agent; If the legality verification report indicates that the device is illegal, the environment has been tampered with, the agent program is incompatible, or the control policy has been tampered with, the user will directly refuse authorization. The security chip will continuously lock all external operation permissions of the security protection device, refuse the execution and forwarding of any agent's operation instructions, and generate an abnormal alarm log.

[0014] In one implementation, based on the legality verification report, and based on a built-in hierarchical rule base, the operation instructions of the verified agent program are hierarchically judged and controlled, including: When the legality verification report shows that the remote verification is successful, an access command is initiated based on the general chip module and forwarded to the intelligent agent in the computing chip via the security chip; The intelligent agent completes large model reasoning and behavioral decision-making, generates operation instructions, and submits the operation instructions to the intelligent agent operation behavior safety management engine built into the computing chip; Based on the built-in hierarchical rule library, the operation instructions are classified and judged in real time, distinguishing between normal operation instructions and dangerous operation instructions, and executing the corresponding local control policies. After receiving a normal operation command, the security chip synchronously performs dynamic measurement on the control policy within the computing chip. After confirming that the control policy has not been tampered with, it performs a final verification of the permission compliance of the normal operation command. After the verification is passed, the normal operation command is forwarded to the general chip module, which then connects to the host business system to complete the corresponding operation. If dynamic measurement detects that the control policy has been tampered with, the normal operation command will be intercepted, the external access of the computing chip will be locked and an alarm will be triggered, and the abnormal status will be reported the next time the user initiates remote verification.

[0015] Thirdly, embodiments of the present invention also provide a terminal, wherein the terminal includes a memory, a processor, and an intelligent agent security protection program based on a trusted execution environment stored in the memory and executable on the processor. When the processor executes the intelligent agent security protection program based on a trusted execution environment, it implements the steps of the intelligent agent security protection method based on a trusted execution environment of any of the above-mentioned schemes.

[0016] Fourthly, embodiments of the present invention also provide a computer-readable storage medium, wherein the computer-readable storage medium stores an intelligent agent security protection program based on a trusted execution environment, and the intelligent agent security protection program based on a trusted execution environment implements the steps of the intelligent agent security protection method based on a trusted execution environment as described in any of the above schemes on the computer-readable storage medium.

[0017] Beneficial Effects: Compared with existing technologies, this invention provides a security protection device for intelligent agents based on a trusted execution environment. The device includes a general-purpose chip module, a security protection module, and a remote verification server module. The general-purpose chip module serves as the user's access point, connecting to the user-side host business system, and is the sole trusted interaction relay unit between the user and the security protection device, and between the intelligent agent and the host business system. The security protection module constructs a trusted execution environment independent of the general-purpose operating system through hardware-level isolation technology. The security protection module includes a security chip and a computing chip. The security chip is the root of trust and the core of measurement and control within the trusted execution environment, while the computing chip is the intelligent agent's operation and control execution unit within the trusted execution environment, and is completely physically isolated from the general-purpose chip module and the host business system. The remote verification server module is a trusted third-party benchmark platform providing legitimacy verification services and is the core response node for user-initiated remote verification. The remote verification server module and the security chip establish an encrypted trusted communication link using national cryptographic algorithms and respond only to verification requests initiated by the user.

[0018] This invention aims to address the core issues of insufficient security, easily tampered control rules, and poor adaptability across all scenarios in existing agent protection solutions. By employing a collaborative mechanism of built-in control execution in the computing chip and hardware-level measurement and anti-tampering in the security chip, it ensures that the control logic cannot be bypassed or tampered with. At the same time, while ensuring normal use by legitimate users and compatibility with various existing business systems, it achieves hardware-level isolation of the agent's operating environment, fine-grained control of operational behavior, and trusted verification throughout the entire process, comprehensively resisting security risks across all scenarios such as unauthorized agent operations, environment tampering, unauthorized access, and uncontrolled behavior. Attached Figure Description

[0019] Figure 1 This is a technical framework diagram of an intelligent agent security protection system based on a trusted execution environment, according to an embodiment of the present invention.

[0020] Figure 2 This is a flowchart of a preferred embodiment of the intelligent agent security protection method based on a trusted execution environment according to the present invention.

[0021] Figure 3 A schematic diagram of a terminal provided in an embodiment of the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and effects of this invention clearer and more explicit, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0023] The flowchart shown in the attached diagram is for illustrative purposes only and does not necessarily include all content, operations, or steps, nor does it require execution in the described order. For example, some operations or steps can be broken down, combined, or partially merged, so the actual execution order may change depending on the actual situation.

[0024] It should be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0025] It should be understood that, in order to clearly describe the technical solutions of the embodiments of the present invention, the terms "first" and "second" are used in the embodiments of the present invention to distinguish identical or similar items with essentially the same function and effect. For example, "first control information" and "second control information" are only used to distinguish different control information and do not limit their order.

[0026] Those skilled in the art will understand that the words "first" and "second" do not limit the quantity or the order of execution, and that the words "first" and "second" do not necessarily imply that they are different.

[0027] It should also be understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0028] Existing security protection solutions for intelligent agents have at least the following technical shortcomings: 1. Software-based protection solutions have underlying security weaknesses and insufficient resistance to attacks. Existing software-based agent behavior control and sandbox isolation solutions heavily rely on the security of general-purpose operating systems. If the operating system itself has vulnerabilities and is compromised, the protection mechanisms and control rules can be easily bypassed or tampered with, failing to provide hardware-level security protection capabilities and making it difficult to resist advanced persistent threats, underlying firmware tampering, and other advanced attacks.

[0029] 2. The control rules lack hardware-level anti-tampering protection, posing a risk of breaching core protection logic. In existing solutions, agent behavior control rules are mostly deployed in general environments or only provide software-level encryption protection, lacking hardware root of trust support. This makes it impossible to achieve integrity verification and dynamic measurement of the control policy throughout its entire lifecycle. Hackers can tamper with the control rules to allow high-risk operations, resulting in a fundamental vulnerability in the protection system.

[0030] 3. Lack of an integrated TEE protection system covering the entire Agent lifecycle, resulting in insufficient adaptability across all scenarios. Existing TEE technologies are mostly applied in fragmented scenarios such as data encryption and single-point authentication, failing to form a trusted protection architecture covering the entire process of Agent deployment, operation, maintenance, and destruction. This makes it unable to adapt to the differentiated deployment needs of various scenarios such as finance, industry, government, and enterprise services, and also unable to achieve end-to-end trusted isolation of the Agent's operating environment.

[0031] 4. The availability and security of agent behavior control cannot be balanced, resulting in insufficient practicality. Existing solutions either have too coarse a granular control, failing to accurately intercept high-risk operations and posing security risks; or the control chain is too long, affecting the efficiency of agent command execution and failing to adapt to low-latency scenarios such as industrial control and financial transactions, making it difficult to balance protection capabilities and business availability.

[0032] 5. Lack of end-to-end trusted verification and closed-loop defense mechanism against unauthorized access. Existing solutions do not combine remote verification to achieve end-to-end integrity verification of the trusted execution environment, agent program, and control policies. They cannot continuously verify the trustworthiness of the entire link during device startup, agent deployment, and operation phases, making it difficult to defend against unauthorized access to the agent's operating environment, program tampering, and hijacking of the operation link by hackers and unauthorized personnel.

[0033] To address the aforementioned deficiencies in existing technologies, the present invention aims to provide an intelligent agent security protection device based on a trusted execution environment. This device constructs an integrated security protection system covering the entire lifecycle of the agent through a hardware-level heterogeneous collaborative architecture and a trusted isolation environment. Specifically, it combines... Figure 1As shown in the figure, the intelligent agent security protection device based on the trusted execution environment in this embodiment is composed of three main units: a general-purpose chip module, a security protection module, and a remote verification server module. The security protection module is the core protection unit. It builds a trusted execution environment independent of the general-purpose operating system based on hardware-level isolation. It integrates security chips and computing chips to form a secure and trusted domain. The entire process of deployment, operation, and computation of the intelligent agent is restricted within the trusted execution environment.

[0034] Specifically, the general-purpose chip module serves as the user's operation access point, used to connect to the user-side host business system, and is the only trusted interaction relay unit between the user and the security protection device, and between the intelligent agent and the host business system.

[0035] The general-purpose chip module in this embodiment is also specifically used for: receiving user (i.e.) Figure 1 Access instructions from legitimate users are forwarded to the security chip within the security protection module via an encrypted and trusted link; normal operation instructions for the intelligent agent are received and verified by the security chip and forwarded to the host business system to execute the corresponding operation, thus completing the implementation of the intelligent agent's business capabilities; the direct access link between the intelligent agent and the host business system is physically blocked, forcing all external operations of the intelligent agent to go through the judgment process of the intelligent agent operation behavior security control engine of the computing chip and the trusted verification process of the security chip.

[0036] The security protection module in this embodiment constructs a trusted execution environment independent of the general-purpose operating system through hardware-level isolation technology. The security protection module includes a security chip and a computing chip. The security chip serves as the root of trust and the core of measurement and control within the trusted execution environment, acting as the trusted benchmark and security control foundation for the entire device. The computing chip is the intelligent agent operation and control execution unit within the trusted execution environment and is completely physically isolated from the general-purpose chip module and the host business system.

[0037] Specifically, the security chip is also used to: collaborate with the remote verification server module to complete the integrity verification of the trusted execution environment during the startup phase of the security protection device and the deployment phase of the intelligent agent, the legality verification of the intelligent agent application, and the verification of the baseline value of the control policy. Only after all verifications pass can the Agent and the control policy be deployed to the computing chip to build a complete trusted chain. The security control policy for the intelligent agent's operational behavior within the computing chip is also subject to static integrity verification at startup and dynamic continuous measurement during runtime. Specifically, the dynamic continuous measurement during runtime includes: verifying the consistency between the hash value of the control policy and the trusted baseline value when the security protection device starts up; and measuring the code and rule base of the control policy in real time at preset intervals during operation to ensure that the control policy is not illegally tampered with or replaced throughout the process. Once a discrepancy is found between the measurement value and the trusted baseline value, the external operation permissions of the computing chip are immediately locked, all external forwarding of Agent commands is blocked, and a security alarm is triggered. The security chip is also used to manage full access permissions to the trusted execution environment, allowing only legitimate users to initiate access through the trusted link of the general chip module, completely blocking unauthorized external personnel and hackers from directly accessing and illegally intruding into the trusted execution environment; and continuously monitoring and measuring the operating status of the computing chip and the integrity of the agent program to ensure the continuous trustworthiness of the agent's operating environment. Once the environment or program is found to have been tampered with, the corresponding permissions are immediately locked and an alarm is triggered.

[0038] The computing chip described in this embodiment is also specifically used to realize the entire process of large-scale model inference, behavioral decision-making, instruction generation, and data computation for all intelligent agents. The complete deployment and operation of the intelligent agents are all within this computing chip, and the operational data never leaves the TEE trusted domain, ensuring data confidentiality. Furthermore, the computing chip has a built-in intelligent agent operation behavior security management engine, which is the local execution entity for agent operation behavior management. Therefore, the computing chip can collect, classify, and initially manage all external operation instructions generated by the intelligent agents in real time, and based on the built-in hierarchical rule base, submit compliant and normal operation instructions to the security chip for final release verification, while intercepting dangerous operation instructions locally without going through external links, reducing management latency. All external operation instructions generated by the agents within the chip can only be processed by the built-in management engine and submitted to the security chip, without any direct external access links, thus preventing uncontrolled agent operations and management bypass at the hardware level.

[0039] Furthermore, the remote verification server module is a trusted third-party benchmark platform that provides legitimacy verification services. It is the core response node for user-initiated remote verification. The remote verification server module and the security chip establish an encrypted and trusted communication link through national cryptographic algorithms and respond only to verification requests initiated by users.

[0040] The remote verification server module in this embodiment is further specifically used for: receiving user-initiated device and agent application legitimacy verification requests; synchronously receiving the device hardware identifier, trusted execution environment integrity metric, agent program hash value, and control policy metric value uploaded by the security chip; and comparing and verifying these against pre-stored genuine device trusted benchmark values, legitimate agent program benchmark hash values, and control policy trusted benchmark values; generating a device and agent application legitimacy verification report based on the verification results, clearly indicating whether the device is a genuine and legitimate device, whether the TEE environment has been tampered with, whether the running Agent application is a legitimate and untampered version, and whether the control policy is complete and trustworthy; and encrypting and feeding back the verification report to the requesting user and the corresponding security chip of the security protection device. Furthermore, the remote verification server module is also used to store genuine device hardware trusted benchmark values, legitimate agent program benchmark hash values, control policy trusted benchmark values, as well as full user verification records, device anomaly alarm logs, and operation audit records, providing complete support for user legitimacy verification and post-event auditing.

[0041] In summary, this embodiment presents an intelligent agent security protection device built upon a Trusted Execution Environment (TEE). Through a collaborative design of a general-purpose chip, a security chip, and a computing chip, it achieves hardware-level isolation and access control throughout the entire process of agent deployment, operation, and management. This constructs a trusted security domain with bidirectional internal and external protection, adaptable to the agent deployment needs of various scenarios across industries. Furthermore, based on the hardware root of trust built into the security chip, it enables full lifecycle verification and dynamic measurement of the integrity of security control policies and the intelligent agent execution engine on the computing chip. This ensures that control policies and the execution engine are not illegally tampered with or bypassed, fundamentally addressing the core security issues of uncontrolled agent behavior and unauthorized operations. Moreover, this invention incorporates a full-link trusted verification system with a remote verification mechanism, covering the entire process from device startup, agent deployment, and operation. This achieves closed-loop verification of TEE environment integrity, agent program legitimacy, control policy trustworthiness, and user identity authenticity, resisting unauthorized tampering and illegal intrusion. Isolation is achieved through security chips, which can block the direct access link of the agent to the host business system's sensitive resources. At the same time, it is compatible with various existing business systems and user operating habits, without the need for large-scale modification of existing systems and agent programs, and can adapt to the deployment needs of all scenarios such as finance, government affairs, industry, and enterprise services.

[0042] Based on the above embodiments, the present invention also provides a method for intelligent agent security protection based on a trusted execution environment, which is implemented based on the above embodiments of intelligent agent security protection devices based on a trusted execution environment. Specifically, the method of this embodiment can be applied to a terminal, which can be an intelligent product such as a computer. Figure 2As shown in the figure, the agent security protection method based on a trusted execution environment in this embodiment includes the following steps: Step S100: Perform trusted initialization and baseline value preset for the intelligent agent security protection device, initiate an intelligent agent deployment request through the general chip module of the intelligent agent security protection device, and securely deploy the intelligent agent program and corresponding management and control policy rules to the computing chip in the trusted execution environment based on the security chip of the intelligent agent security protection device, thereby completing the trusted deployment of the intelligent agent.

[0043] Specifically, before leaving the factory, the intelligent agent security protection device first completes the hardware trusted root programming, and the security chip completes its own firmware verification, generating a unique hardware identifier and a hardware trusted benchmark value, thus constructing the basic trusted chain of the trusted execution environment. Next, the unique hardware identifier, the hardware trusted benchmark value, and the basic trusted benchmark value of the trusted execution environment are encrypted and uploaded to the remote verification server module, completing the benchmark value pre-setting for genuine devices and providing a trusted comparison benchmark for subsequent user legitimacy verification. Then, when the intelligent agent security protection device is powered on, the security chip completes its own hardware trusted root verification and basic integrity verification of the trusted execution environment, locking all external access links of the computing chip and retaining only the internal trusted link with the security chip. The device then enters a state of pending deployment and verification.

[0044] Furthermore, the user initiates an agent deployment request through the general-purpose chip module. After verification by the security chip, the user's identity is trusted and their operation permissions are verified. Once the user's identity is successfully authenticated, the user uploads the agent program package and the corresponding management policy rule package to the agent security protection device. The security chip calculates hash values ​​for both the agent program package and the management policy rule package to generate an initial trusted baseline value. Next, the security chip binds the agent program hash value, the management policy baseline value, and the device's unique hardware identifier, then encrypts and uploads them to the remote verification server module, completing the synchronization and storage of the baseline value for the legitimate agent program. Then, the security chip securely deploys the agent program and the corresponding management policy rules to the computing chip within the trusted execution environment, completing the trusted deployment of the agent. After deployment, the agent can only run within the computing chip; all its external operations must undergo hierarchical processing by the built-in management engine, with no other external access links. The device then enters a state awaiting user verification and use.

[0045] Step S200: Initiate a remote verification request for the legitimacy of the device and the intelligent agent application through the general chip module, and complete the remote verification of the legitimacy of the device and the intelligent agent application based on the remote verification server module, and generate a legitimacy verification report.

[0046] This stage is a mandatory pre-processing step before each use of the security protection device and Agent by the user. The user initiates the process, and the core objective is to verify the legitimacy and trustworthiness of the current device and running Agent application. Specifically, before initiating a request to use the intelligent agent security protection device, the user first initiates a remote verification request for the legitimacy of the device and intelligent agent application through the general-purpose chip module, simultaneously completing trusted authentication of the user's identity. Upon receiving the user's verification request, the security chip collects the device's unique hardware identifier, the real-time integrity metric of the trusted execution environment, calculates the real-time hash value of the intelligent agent program running within the chip, and the real-time integrity metric of the control policy in real time. It then generates verification data, sends it to the user, and encrypts and uploads it to the remote verification server module. Next, the remote verification server module receives the user's verification request and the verification data uploaded by the security chip. It compares the verification data with pre-stored hardware trust benchmark values ​​for the corresponding device, the bound legitimate intelligent agent program benchmark hash value, and the control policy trust benchmark value, generating a legitimacy verification report. Finally, the remote verification server module encrypts and sends the legitimacy verification report back to the requesting user and the corresponding security chip of the security protection device. The user can view the verification report through the general-purpose chip module to confirm the legitimacy of the device and intelligent agent application.

[0047] In one implementation, if the legitimacy verification report shows that the device is a genuine and legitimate device, the trusted execution environment is complete and unaltered, the running intelligent agent application is a bound, legitimate, and unaltered version, and the control policy is complete and trustworthy, after the user confirms that the verification is successful, an operation authorization instruction is issued to the security protection device, allowing the user to initiate operation access to the intelligent agent; if the legitimacy verification report shows that the device is illegal, the environment has been tampered with, the intelligent agent program is incompatible, or the control policy has been tampered with, the user directly refuses authorization, the security chip continuously locks all external operation permissions of the security protection device, refuses the execution and forwarding of any intelligent agent operation instructions, and generates an abnormal alarm log.

[0048] Step S300: Based on the legality verification report, the operation instructions of the verified intelligent agent program are classified and controlled according to the built-in hierarchical rule base, and access is blocked or instruction is denied for illegal access and unverified intelligent agent programs.

[0049] Specifically, when the legality verification report shows that remote verification has passed, an access command is initiated based on the general-purpose chip module and forwarded to the intelligent agent within the computing chip via the security chip. The intelligent agent completes large-scale model reasoning and behavioral decision-making, generates operation commands, and submits the operation commands to the intelligent agent operation behavior security management engine built into the computing chip. Then, based on the built-in hierarchical rule base, the operation commands are classified and judged in real time, distinguishing between normal operation commands and dangerous operation commands, and executing the corresponding local control policies. In one implementation, if the operation command is a preset dangerous operation command (such as system permission modification, batch export of sensitive data, unauthorized network address access, storage formatting, high-risk control commands for industrial equipment, large-value financial transaction commands, execution of system underlying commands, etc.), it is directly intercepted locally on the computing chip, blocking the operation execution link, and generating a security alarm log, which is synchronized to the security chip and the remote verification server. If the operation command is a preset normal operation command (such as compliant business file reading, regular application operations, data processing within the authorized scope, compliant device control commands, etc.), the operation command and verification information are submitted to the security chip for final trusted verification.

[0050] Next, upon receiving a normal operation command, the security chip simultaneously performs dynamic measurement on the control policy within the computing chip. After confirming that the control policy has not been tampered with, it performs a final verification of the permission compliance of the normal operation command. If the verification passes, the normal operation command is forwarded to the general-purpose chip module, which then interfaces with the host business system to complete the corresponding operation. If the dynamic measurement detects that the control policy has been tampered with, the normal operation command is intercepted, the computing chip's external permissions are locked, an alarm is triggered, and the abnormal status is reported the next time a user initiates remote verification.

[0051] Furthermore, in other implementations, this embodiment can also block access or deny commands for unauthorized access and failed authentication of intelligent agent programs. Specifically, when an unauthorized external person (hacker) initiates an access request to the security protection device, they cannot directly access the security chip and computing chip within the TEE environment; they can only access the general-purpose chip module. Then, the general-purpose chip module performs initial identity verification on the access request. If the request is from an illegitimate user, it is directly blocked, preventing remote authentication and operation access. If the request attempts to bypass the general-purpose chip module and directly access the TEE environment, the security chip's access control engine will directly reject all access requests from untrusted links, completely blocking unauthorized access links. If the user's remote authentication fails, or the user refuses to issue operation authorization commands, the security chip continuously locks all external operation permissions of the security protection device, rejecting the execution and forwarding of any agent commands and user operation access, ensuring that unauthorized devices and tampered applications cannot be used.

[0052] In summary, compared with the prior art, the present invention has at least the following technical effects: 1. Achieve high-security protection at the hardware level, ensuring that the control logic is immutable and unbypassable from the root. This invention decouples the execution of control policies from trusted assurance through a collaborative mechanism of "built-in control execution in the computing chip and hardware-level measurement and anti-tampering in the security chip." It achieves both local low-latency control of agent commands and anti-tampering protection of the control policy throughout its entire lifecycle through a hardware root of trust. This completely solves the core vulnerability of existing solutions where control rules are easily tampered with and bypassed. Compared with traditional software-level protection solutions, it has higher resistance to attacks and can effectively resist advanced persistent threats, underlying firmware tampering, illegal intrusion, and other advanced attack behaviors.

[0053] 2. A trusted protection closed loop covering the entire lifecycle of the Agent is constructed, offering strong adaptability across all scenarios. This invention covers the entire process from device startup, Agent deployment, operation, and unauthorized access prevention. Combined with a remote verification mechanism, it achieves full integrity and legality verification of the TEE environment, Agent program, and control policies, constructing a complete trusted chain. Furthermore, it is adaptable to various industry scenarios such as financial transactions, government data processing, industrial automation, enterprise business automation, and IoT edge computing, without requiring large-scale architectural adjustments for different scenarios, thus solving the problem of insufficient scenario adaptability in existing solutions.

[0054] 3. Achieve refined hierarchical control over agent operations, perfectly balancing security and business availability. This invention utilizes a local control engine on the computing chip to achieve real-time hierarchical interception of commands, significantly reducing control latency and adapting to low-latency scenarios such as industrial control and financial transactions. Simultaneously, dynamic measurement through a security chip ensures the reliability of the control logic, avoiding excessive control from impacting the agent's normal business execution and fundamentally addressing the security risks arising from uncontrolled agent behavior and unauthorized operations, thus achieving a two-way balance between security and availability.

[0055] 4. It possesses strong compatibility and practicality, with extremely low deployment costs. This invention connects to various existing host business systems and user operating habits through a universal chip module, achieving hardware-level security protection without requiring large-scale modifications to existing business systems or agent programs. It has a low deployment threshold, strong adaptability, and can be widely applied to various private and large-scale agent deployment scenarios, possessing extremely high commercial value.

[0056] 5. Achieve closed-loop security protection both internally and externally. This invention, on the one hand, blocks unauthorized access to the Agent's operating environment by unauthorized personnel, preventing the theft and tampering of Agent programs, control policies, and core data; on the other hand, it blocks direct access by the Agent to sensitive resources of the host business system. All operations must undergo hierarchical control and trusted verification, achieving two-way protection against external intrusion and internal loss of control, comprehensively covering the core security risks of Agent's large-scale application across all scenarios.

[0057] Based on the above embodiments, the present invention also provides a terminal, the principle block diagram of which can be as follows: Figure 3 As shown. The terminal may include one or more processors 100 ( Figure 3 (Only one is shown in the image), memory 101, and computer program 102 stored in memory 101 and executable on one or more processors 100. For example, an agent security protection program based on a trusted execution environment. When one or more processors 100 execute computer program 102, they can implement the various steps in the embodiment of the agent security protection method based on a trusted execution environment. Alternatively, when one or more processors 100 execute computer program 102, they can implement the functions of each module / unit in the embodiment of the agent security protection device based on a trusted execution environment, which is not limited here.

[0058] In one embodiment, the processor 100 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0059] In one embodiment, memory 101 can be an internal storage unit of the terminal, such as a hard disk or RAM. Memory 101 can also be an external storage terminal of the terminal, such as a plug-in hard disk, smart media card (SM), secure digital card (SD), flash card, etc., all equipped on the terminal. Furthermore, memory 101 can include both internal and external storage units. Memory 101 is used to store computer programs and other programs and data required by the terminal. Memory 101 can also be used to temporarily store data that has been output or will be output.

[0060] Those skilled in the art will understand that Figure 3 The block diagram shown is merely a partial structural diagram related to the present invention and does not constitute a limitation on the terminal to which the present invention is applied. A specific terminal may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0061] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided by this invention can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), direct memory bus RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0062] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A security protection device for intelligent agents based on a trusted execution environment, characterized in that, The device includes: The general-purpose chip module serves as the user's operation access point, connecting to the user-side host business system. It is the only trusted interaction relay unit between the user and the security protection device, and between the intelligent agent and the host business system. The security protection module constructs a trusted execution environment independent of the general-purpose operating system through hardware-level isolation technology. The security protection module includes a security chip and a computing chip. The security chip is the root of trust and the core of measurement and control of the trusted execution environment. The computing chip is the intelligent agent operation and control execution unit in the trusted execution environment and is completely physically isolated from the general-purpose chip module and the host business system. The remote verification server module is a trusted third-party benchmark platform that provides legitimacy verification services. It is the core response node for user-initiated remote verification. The remote verification server module and the security chip establish an encrypted and trusted communication link through national cryptographic algorithms and only respond to verification requests initiated by users.

2. The intelligent agent security protection device based on a trusted execution environment according to claim 1, characterized in that, The general-purpose chip module is also specifically used for: Upon receiving a user's access command, it forwards it to the security chip within the security protection module via an encrypted and trusted link; The system receives the normal operation command of the intelligent agent after verification and approval by the security chip, and forwards it to the host business system to execute the corresponding operation, thereby completing the implementation of the intelligent agent's business capabilities. Physically block the direct access link between the intelligent agent and the host business system, and force all intelligent agents to perform external operations through the judgment process of the intelligent agent operation behavior security control engine of the computing chip and the trusted verification process of the security chip.

3. The intelligent agent security protection device based on a trusted execution environment according to claim 1, characterized in that, The security chip is also specifically used for: In conjunction with the remote verification server module, it completes the integrity verification of the trusted execution environment during the startup phase of the security protection device and the deployment phase of the intelligent agent, the legality verification of the intelligent agent application, and the verification of the baseline value of the control strategy, so as to build a complete trusted chain. The security management strategy for the operation behavior of the intelligent agent within the computing chip includes static integrity verification at startup and dynamic continuous measurement during runtime. It manages full access permissions to the trusted execution environment and continuously monitors and measures the operating status of the computing chip and the integrity of the agent program.

4. The intelligent agent security protection device based on a trusted execution environment according to claim 3, characterized in that, The computing chip is also specifically used for: It enables the entire process of large-scale model reasoning, behavioral decision-making, instruction generation, and data computation for all intelligent agents; All external operation commands generated by the intelligent agent are collected in real time, classified and judged, and initially controlled. Based on the built-in classification rule base, compliant and normal operation commands are submitted to the security chip for final release verification, while dangerous operation commands are intercepted locally.

5. The intelligent agent security protection device based on a trusted execution environment according to claim 3, characterized in that, The remote verification server module is also specifically used for: The system receives a user-initiated request to verify the legitimacy of the device and intelligent agent application. Simultaneously, it receives the device hardware identifier, trusted execution environment integrity metric, intelligent agent program hash value, and control policy metric value uploaded by the security chip, and compares and verifies them with the pre-stored trusted benchmark values ​​of genuine devices, legitimate intelligent agent programs, and control policy. Based on the verification results, a legality verification report for the device and intelligent agent application is generated, and the verification report is encrypted and fed back to the user who initiated the request and the security chip of the corresponding security protection device.

6. A method for protecting the security of intelligent agents based on a trusted execution environment, characterized in that, The method is implemented based on the intelligent agent security protection device based on a trusted execution environment as described in any one of claims 1-5, and the method includes: The intelligent agent security protection device is initialized with a trusted value and a baseline value is preset. The intelligent agent deployment request is initiated through the general chip module of the intelligent agent security protection device. Based on the security chip of the intelligent agent security protection device, the intelligent agent program and the corresponding management and control policy rules are securely deployed to the computing chip in the trusted execution environment, thus completing the trusted deployment of the intelligent agent. The system initiates a remote verification request for the legitimacy of the device and intelligent agent application through a general-purpose chip module, and completes the remote verification of the legitimacy of the device and intelligent agent application based on the remote verification server module, generating a legitimacy verification report. Based on the aforementioned legality verification report, the operation instructions of the verified intelligent agent program are classified and controlled according to the built-in hierarchical rule base, and access is blocked or instruction is denied for illegal access and intelligent agent programs that fail verification.

7. The agent security protection method based on a trusted execution environment according to claim 6, characterized in that, The process involves: performing trusted initialization and baseline value preset for the agent security protection device; initiating an agent deployment request through the general-purpose chip module of the agent security protection device; and securely deploying the agent program and corresponding control policy rules to the computing chip within the trusted execution environment based on the security chip of the agent security protection device, thereby completing the trusted deployment of the agent, including: Before leaving the factory, the intelligent agent security protection device completes the hardware trusted root programming, the security chip completes its own firmware verification, generates a unique hardware identifier and hardware trusted benchmark value, and builds the basic trusted chain of the trusted execution environment. The device's unique hardware identifier, hardware trusted baseline value, and trusted execution environment's basic trusted baseline value are encrypted and uploaded to the remote verification server module to complete the baseline value preset for genuine devices. When the intelligent agent security protection device is powered on, the security chip completes its own hardware root of trust verification and basic integrity verification of the trusted execution environment, locks all external access links of the computing chip, and retains only the internal trusted link with the security chip. Users initiate intelligent agent deployment requests through general-purpose chip modules. After verification by security chips, the user's identity is trusted and operation permissions are verified. After user identity authentication is successful, the user uploads the intelligent agent program package and the adapted control policy rule package to the intelligent agent security protection device. The security chip calculates the hash value of the intelligent agent program package and the control policy rule package respectively to generate an initial trusted baseline value. After binding the hash value of the intelligent agent program, the baseline value of the control policy, and the unique hardware identifier of the device through the security chip, the data is encrypted and uploaded to the remote verification server module to complete the synchronization and storage of the baseline value of the legitimate intelligent agent program. By using a security chip, the intelligent agent program and its corresponding management and control policy rules are securely deployed to the computing chip within a trusted execution environment, thus completing the trusted deployment of the intelligent agent.

8. The intelligent agent security protection method based on a trusted execution environment according to claim 6, characterized in that, The system initiates a remote verification request for the legitimacy of the device and the intelligent agent application through a general-purpose chip module, and completes the remote verification of the legitimacy of the device and the intelligent agent application based on the remote verification server module, generating a legitimacy verification report, including: Before a user initiates a request to use the intelligent agent security protection device, a remote verification request for the legitimacy of the device and the intelligent agent application is initiated through a general chip module, while the user's identity is verified in a trusted manner. After receiving the user's verification request, the security chip collects the current device's unique hardware identifier, the real-time integrity metric of the trusted execution environment, calculates the real-time hash value of the intelligent agent program running in the chip, and the real-time integrity metric of the control policy in real time, and generates verification data that is encrypted and uploaded to the remote verification server module. The remote verification server module receives the user's verification request and the verification data uploaded by the security chip. It compares and verifies the verification data with the pre-stored hardware trusted benchmark value of the corresponding device, the benchmark hash value of the bound legitimate intelligent agent program, and the trusted benchmark value of the control policy one by one, and generates a legitimacy verification report. The remote verification server module encrypts and sends the legitimacy verification report back to the user who initiated the request and the security chip of the corresponding security protection device. The user can view the verification report through the general chip module to confirm the legitimacy of the device and the smart agent application. If the legality verification report shows that the device is a genuine and legitimate device, the trusted execution environment is complete and untampered, the running intelligent agent application is a bound, legitimate, and untampered version, and the control policy is complete and trustworthy, after the user confirms that the verification is passed, an operation authorization instruction is issued to the security protection device, allowing the user to initiate operation access to the intelligent agent; If the legality verification report indicates that the device is illegal, the environment has been tampered with, the agent program is incompatible, or the control policy has been tampered with, the user will directly refuse authorization. The security chip will continuously lock all external operation permissions of the security protection device, refuse the execution and forwarding of any agent's operation instructions, and generate an abnormal alarm log.

9. The intelligent agent security protection method based on a trusted execution environment according to claim 6, characterized in that, Based on the aforementioned legality verification report, and using a built-in hierarchical rule base, the operation instructions of the verified intelligent agent program are classified and controlled, including: When the legality verification report shows that the remote verification is successful, an access command is initiated based on the general chip module and forwarded to the intelligent agent in the computing chip via the security chip; The intelligent agent completes large model reasoning and behavioral decision-making, generates operation instructions, and submits the operation instructions to the intelligent agent operation behavior safety management engine built into the computing chip; Based on the built-in hierarchical rule library, the operation instructions are classified and judged in real time, distinguishing between normal operation instructions and dangerous operation instructions, and executing the corresponding local control policies. After receiving a normal operation command, the security chip synchronously performs dynamic measurement on the control policy within the computing chip. After confirming that the control policy has not been tampered with, it performs a final verification of the permission compliance of the normal operation command. After the verification is passed, the normal operation command is forwarded to the general chip module, which then connects to the host business system to complete the corresponding operation. If dynamic measurement detects that the control policy has been tampered with, the normal operation command will be intercepted, the external access of the computing chip will be locked and an alarm will be triggered, and the abnormal status will be reported the next time the user initiates remote verification.

10. A terminal, characterized in that, The terminal includes a memory, a processor, and an agent security protection program based on a trusted execution environment stored in the memory and executable on the processor. When the processor executes the agent security protection program based on a trusted execution environment, it implements the steps of the agent security protection method based on a trusted execution environment as described in any one of claims 6-9.

Images